Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.6
CVE-2025-71367: picklescan: Malicious Pickle Files Can Execute Code Remotely
CVE-2025-71367
CVE-2025-71367
Summary
picklescan, a tool used to detect malicious pickle files, has a flaw that allows attackers to create malicious files that can execute code remotely. This means that attackers can potentially take control of a system by sending a specially crafted file. To protect against this, users should update to the latest version of picklescan, which fixes this issue.
What to do
No fix is available yet. Check with your software vendor for updates.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| picklescan | picklescan | < 0.0.34 |
Original title
picklescan before 0.0.34 fails to detect _operator.attrgetter function calls in pickle payloads, allowing attackers to bypass security checks. Remote attackers can craft malicious pickle files usin...
Original description
picklescan before 0.0.34 fails to detect _operator.attrgetter function calls in pickle payloads, allowing attackers to bypass security checks. Remote attackers can craft malicious pickle files using _operator.attrgetter in reduce methods to execute arbitrary code when pickle.load() processes the file.
mitre CVSS3.1
8.1
Vulnerability type
CWE-502
Deserialization of Untrusted Data
Published: 4 Jul 2026 · Updated: 23 Jul 2026 · First seen: 4 Jul 2026